Certification authority issues

Hi All, i have a CA setup on a windows 2008R2 box and now when i log into the
it asks for my creds and doesnt let me in. i tried my regular and domain admin account. when i log in locally i see the cert page come up but have issues when trying to request a cert.
i get the following error when logged in locally:
no certificate templates could be found. You do not have permissiosn to request a certificate CA, or an error occurred while accessing the Active Directory.
in the system event i see the following error:
Log Name: System
Source: Schannel
Date: 3/21/2014 12:32:04 PM
Event ID: 36871
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Description:
A fatal error occurred while creating an SSL client credential. The internal error state is 10013.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
<EventID>36871</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2014-03-21T18:32:04.592025500Z" />
<EventRecordID>224668</EventRecordID>
<Correlation />
<Execution ProcessID="512" ThreadID="3548" />
<Channel>System</Channel>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="Type">client</Data>
<Data Name="ErrorState">10013</Data>
</EventData>
</Event>
this was working fine with no issues and changes were not made that i am aware of. i checked the permissions and things look good.
i also tried this and it didnt work:
http://support.microsoft.com/kb/811418/en-us

you have to add this web server to Local Intranet zone. Also, check the following:
you are entering web server name (not IP address) in the address bar
web site uses HTTPS binding
anonymous authentication is disabled and Integrated Authentication is enabled.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new:
SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.

Similar Messages

Move Certification Authority Web Enrollment to new server issue.

Hello,
i'm trying to move the Certification Authority Web Enrollment from one server to a new one. I've got a fully functional server where i can enroll any certificate i want and everything is working properly.
on the new server i configured I'm facing a problem that seems to be an impersonation issue. Indeed, while i try to enroll a certificate i get the following error msg from the interface :
Request Mode:
newreq - New Request
Disposition:
(never set)
Disposition message:
(none)
Result:
The RPC server is unavailable. 0x800706ba (WIN32: 1722)
COM Error Info:
CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722)
LastStatus:
The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause:
This error can occur if the Certification Authority Service has not been started.
an i can also see on the CA it targets the following application error event :
Event 18209, ComRuntime:
The application-specific permission settings do not grant Local access permission to the COM Server application C:\Windows\system32\certsrv.exe with APPID
{D99E6E74-FC88-11D0-B498-00A0C90312F3}
to the user NT AUTHORITY\ANONYMOUS LOGON SID (S-1-5-7) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
While i register a certificate on the server were it all works fine i can see event in the Security log on the CA that authenticate the user i generate the certificate with, where-as with the server were it does not work, all seems to be anonymous.
IIS configuration are identical on both servers and the delegation has been set identically too ( ADUC object )
Any idea how what I could check next?

Hi,
Regarding event 18209, please follow steps from this article below to assign access permissions for the user mentioned in the event message:
Event ID 18209 — COM Security Policy Configuration
http://technet.microsoft.com/en-us/library/cc726319(v=WS.10).aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Firefox does not recognize SSL Certificate issuer Entrust Certification Authority – L1K, but Entrust Certification Authority – L1C is ok?

We have a new Entrust SSL Certificate with issuer Entrust Certification Authority – L1K which Firefox does not recognize. Internet Explorer and Chrome are ok.
On a different system we have an Entrust SSL Certificate with issuer Entrust Certification Authority – L1C which is ok with Firefox.

Did you verify that all intermediate certificates are installed on the server?
You can inspect the certificate chain via a site like this:
*http://www.networking4all.com/en/support/tools/site+check/
*https://www.ssllabs.com/ssltest/

Issue generating a subordinate certificate - The certification authority's certificate contains invalid data

Other recipients:
Hi Guys, I have a root CA and a sub CA. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error: The certification authority's certificate contains
invalid da
<input role="presentation" style="width:1px;height:1px;opacity:0;" tabindex="-1" type="text" />
Hi Guys,
I have a root CA and a sub CA both windows 2008 R2 ent. I want to generate another Sub CA certificate from my current sub CA however when I try to do so either via web or csr file I get the below error:
The certification authority's certificate contains invalid data. 0x80094005 (-2146877435). Denied by policy module.
I have confirmed that the basic constraint attribute for my current subca is none so I should be able to generate a certificate for a new subca.
Any assistance is greatly appreciated.
Thanks.

Hi,
According to your description, you want to build a new CA which is under an existing sub CA (one of your two working sub CAs) to issue certificates to other devices, am I right?
Based on my research, to achieve this, we need to install another
Subordinate Certification Authority. During the installation process, this new sub CA will generate a certificate request to its parent CA.
“The subordinate CA cannot be used until it has been issued a root CA certificate and this certificate has been used to complete the installation of the subordinate CA”, I quoted this
sentence from the article I posted in my last reply.
Therefore, in your case, the process flow should be like:
Install a new sub CA.
Generate a certificate request to its parent CA during installation.
The parent CA approves this request.
Installation of the subordinate CA has completed.
The new sub CA issues new certificates to other devices.
Please feel free to let me know if this method is not working.
Best Regards,
Amy Wang

Using Hyper-V 2012 r2, connecting to the console results in: A certification authority could not be contacted for authentication.

I'm having some trouble with authentication to guests from my Hyper-V console.
If I try to connect from the Hyper-V Manager to the console of any guest, I get the error:
"A certification authority could not be contacted for authentication. If you are using a Remote Desktop Gateway with a smart card, try connecting to the remote computer using a password. For assistance, contact your system administrator or technical support."
I'm not using an RDG and smart card.
I have 2 virtual networks. The first is Production, the second is Isolated. Production has 2 NICs attached to the Production LAN, the second has 2 NICs in our DMZ. The host is a member server of the production domain. I can use MSTSC from the LAN or the DMZ
to gain access to each Guest and the Host.
The issues start if I try "Connect" from Hyper-V Manager in an attempt to use the console of any Guest. Each attempt fails with the above error. If I use an incorrect password, I get a different error: "The credentials that were used to connect
to {Server FQDN} did not work. Please enter new credentials."
Taking a look at the the event logs, I can see the session successfully authenticating to the Guest (4776 Credential validation and 4624 Logon), and the fact I get a different error if I enter an incorrect password show I get some way along the line. However
if I take a look at the logs on the Host, however I get:
An account failed to log on.
   Subject:
       Security ID:       NULL SID
       Account Name:       -
       Account Domain:       -
       Logon ID:       0x0
   Logon Type:           3
   Account For Which Logon Failed:
       Security ID:       NULL SID
       Account Name:
       Account Domain:
   Failure Information:
       Failure Reason:       An Error occured during Logon.
       Status:           0xC000006D
       Sub Status:       0xC000005E
   Process Information:
       Caller Process ID:   0x0
       Caller Process Name:   -
   Network Information:
       Workstation Name:   -
       Source Network Address:   -
       Source Port:       -
   Detailed Authentication Information:
       Logon Process:       Kerberos
       Authentication Package:   Kerberos
       Transited Services:   -
       Package Name (NTLM only):   -
       Key Length:       0
   This event is generated when a logon request fails. It is generated on the computer where access was attempted.
   The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
   The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
   The Process Information fields indicate which account and process on the system requested the logon.
   The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
   The authentication information fields provide detailed information about this specific logon request.
       - Transited services indicate which intermediate services have participated in this logon request.
       - Package name indicates which sub-protocol was used among the NTLM protocols.
       - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Which looks to me like a blank authentication request is being sent? (I've not deleted any machine/domain names, they're just not present)
Any suggestions? Do you think I'm barking up the wrong tree?
Thoughts and comments gratefully received

Hi,
What’s your guest system platform, base on my experience that must be the not supported guest system issue, the generation 2 vm only support the Windows 8 or 8.1 platform.
The related KB:
Generation 2 Virtual Machine Overview
http://technet.microsoft.com/en-us/library/dn282285.aspx
Hope this hleps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Upgrading PowerShell 2.0 to 3.0 on a Windows Server 2008 SP 2 Enterprise Certification Authority server

Hello All:
Are there any caveats to upgrading PowerShell 2.0 to 3.0 on a customer's Certification Authority server? The customer will also be upgrading to SCCM 2012 and employ this server as a Distribution Point.
Any feedback would be greatly appreciated.
Thank you.

Hi Erik,
I haven't tried to upgrade powershell on Certification Authority server, however, Windows Management Framework 3.0 requires Microsoft .NET Framework 4.0, and you need to change .NET version on server 2008 SP2.
For more detailed installation instruction, please follow this article:
Windows Management Framework 3.0
If there is anything else regarding this issue, please feel free to post back.
Best Regards,
Anna Wang

What is the certification authority, the third party that can confirm the digital signature?

I created a nice electronic signature, that I now regularly use and add to every document. I was told that a signature needs to be issued by a verification authority, a third party that is able to verify the signature, certificate. I created a free certificate at CAcert.org and tried to combine it with the adobe signature certificate file, but it doesnt support .cer and .crt files. Is the Adobe the certification authority in this case since i created signature in the Adobe software? Its not a big deal, I just want everything to be correct since I use the signature in official documents now (instead of scanning a signed document) ... Thanks for any info, ideas or help.
Jacob

Each Digital Certificate has a pair of private and public keys used for encryption/decryption. The private key belongs to the certificate owner and should be kept secret. It is protected by a password. The public key can be used by anyone. Digital certificates come in two flavors: one that contains both private and public key and one that contains only public key.
When you create a digital signature the signing process uses the private key to encrypt the signed content digest and the public key is used to decrypt it. So, only you can encrypt signed content with your certificate that has both private and private keys and anyone can decrypt it to validate the signature using certificate that has only public key. Usually, this certificate with the public key only is embedded in the digital signature, so that anyone can use it for decryption.
The .cer certificate contains only public key. Certificates with both private and public keys usually have extensions .pfx or .p12. You need one of those to sign.
CAcert.org issues only public key certificates. so you cannot use its certificates for digital signing.
Adobe is not a general purpose certification authority. It issues some certificates for internal use only.
Acrobat has a feature that allows you to create so-called self-signed certificates with both private and public keys but these certificates can be used only in a limited way. They do not provide the means to authenticate the real certificate owner nor revoke a certificate if it is stolen.
Generally, a digital signature asserts three main features:
1. Document integrity (document has not been changes since it had been signed),
2. Authentication (the signer is indeed what the certificate says)
3. Non-repudiation (the signature author cannot deny that he signed it: this is achieved via certificate revocation mechanism).
A self-signed certificate (of the type that Acrobat produces) can be used only for #1. It cannot be used for ##2 and 3. The latter two come only when a certificate (with private key) is issued by a reputable Certificate Authority which is trusted (like VeriSign, Symantec, etc.).

Certification authority - Migration

Hello people,
I have a certification authority installed on my
DC.
I need to migrate this certification authority
to another server with just
this function and remove the DC.
How can I do this safely,
without impacting applications that depend on the
certification authority, with certificates issued?
I have a domain with 2
domain controllers, Windows Server 2008R2,
200 users.
thank you

Hi,
Here is a detailed CA migration guide article below I suggest you refer to:
Active Directory Certificate Services Migration Guide
http://technet.microsoft.com/en-us/library/ee126170(v=WS.10).aspx
I hope this helps.
Best Regards,
Amy Wang

CWMS Certificate Authority issue

Hi Everyone,
I've an issue with my CWMS Certificate Authority (CA),
I can't login into my CWMS from IPad (public),
error message is "This Certificate is not from a trusted authority".
I can login and join webex meeting from laptop (local and public),
everything is fine if I use laptop,
Error message from IPad attached.
Please advise
Ovindo

Hi Ovindo,
Are you using SSL certificate issued by a public/official Certification Authority or self-signed certs? If you are using SSL certs by a public CA, ensure you uploaded intermediate certs to CWMS as well. Please, take a look at this article for more info: http://www.cisco.com/en/US/docs/collaboration/CWMS/1_5/Troubleshooting_Guide_chapter_01.html#reference_EA8E3F4F2B12484F8433FB7FC4EF018F
I hope this helps.
Dejan

Certification Authority Backup and Redundancy

Hi,
I have installed Certification Authority on One of my DCs (Windows 2008 R2 Standard), to serve certificated for Exchange and Lync and other applications, I have few questions if you guys can reply me.
1- What will happen if this server goes down , All certificated installed on Client server will stop working
2- How can i backup this CA server to restore it.
3- Is there any way that i can make redundant of this CA.
Regards
Usman Ghani
Usman Ghani - MCITP Exchange 2010

1 - Certificates cannot be validated anymore if the most recent revocation list (CRL) expires and the CA is not available to sign new CRLs. If you had used default settings delta CRLs are valid for one day so after one day application checking CRLs (not
all do!) would report issues.
2 - You should backup the CA's key and certificate (manually, only after setup or renewal, certsrv.msc). The registry key of the CertSvc service (config.) and the database should be backed up regularly (certutil -backupdb). Restoring the CA is similar to
migrating a CA to a new server: You import the key and add the role, using the option "Existing key and certificate".
3 - There is no option for 100% redundancy: Setting up a second CA (with a different cert. and key) only makes the service for issuing certificate high-available, but the second CA cannot sign CRLs on behalf of the first. (And you cannot have two CAs with
the same Subject name in AD). You could use Windows Clustering but in this case the database is on a Shared Storage - but I guess that is not an option anyway if the CA is on a DC.
I would rather recommend planning CRL validity periods and overlaps (new CRLs published while the existing one still valid) so that you would have enough time to restore the service in case of a disaster. If the CA goes down before a few days of bank holidays:
How long would it take for somebody to be notified and the backup to be restored? I would not use delta CRLs unless you plan for extremely frequent revocations and have bandwidth issues but rather use only base CRLs.
Elke

Certification Authority

We installed the Certification Authority service on a 2008 server. How do we issue a certificate to a user to allow them to digitally sign Excel and Word documents? When I try to sign a document the only certificate available says
it cannot be verified.

Hi,
Based on my research, we must obtain a digital certificate before we can obtain a digital signature. Therefore, we need to request a
Code Signing certificate for this usage.
Here are some related links below that could be useful to you:
Walkthrough: Request a Digital Certificate from Certificate Server or create a testing Digital Certificate to sign a Package
http://blogs.msdn.com/b/sqlforum/archive/2011/01/03/walkthrough-request-a-digital-certificate-from-certificate-server-or-create-a-testing-digital-certificate-to-sign-a-package.aspx
Description of digital certificates
http://support.microsoft.com/kb/206637
What is a digital signature?
http://technet.microsoft.com/en-us/library/cc545901(v=Office.12).aspx
I hope this helps.
Best Regards,
Amy Wang

Why do other browsers ( IE, Chrome, Opera,Safari) list StartCom Class 2 Primary Intermediate Server CA as a Trusted Intermediate Certification Authority but Firefox doesn't?

We are setting up registrations for a paid event and have bought a SSL certificate for our site. Everything works fine when the registration page is accessed through IE, Chrome, Opera or Safari (which list StartCom Class 2 Primary Intermediate Server CA as a Trusted Intermediate Certification Authority), but when I click on that link in Firefix I get the "This Connection is Untrusted" page because only StartCom Class 1 is listed as trusted.
Why is that?

It is always the responsibility of a website to send the complete certificate chain.
You can check the certificate chain of breastfeedingconference.asn.au and see that the server doesn't send the intermediate certificate.
* http://www.networking4all.com/en/support/tools/site+check/

Usefullness of Certification Authority Web Enrollment?

If a deployment has Certificate Enrollment Web Service and
Certificate Enrollment Policy Web Service installed is there still a need for
Certification Authority Web Enrollment? This Windows Server 2012 CA design has an offline root CA, two Enterprise Subordinate CAs in a cluster, and two web servers hosting AIA/CDP/OCSP/CES and CEP behind a load balancer. There is
also a standalone NDES server.
Thanks

Starting with Windows Server 2008, web enrollment become useless as it allows only user certificates, therefore you should avoid web enrollment installation whenever it is possible. As for CEP/CES, there is a dependency that only Windows 7+ supports it.
My weblog: http://en-us.sysadmins.lv
PowerShell PKI Module: http://pspki.codeplex.com
Check out new:
PowerShell FCIV tool.

Does OIM Connector for Lotus Notes support Domino certification authority?

Lotus Notes allows an Organization to register servers and users without stamping each server ID and user ID if you have migrated the certifier to a Domino server-based certification authority (CA).
A Customer has done such a migration to a server-based certification authority (CA), and therefore they have set up Notes and Internet certifiers to use the CA process.
So, now this Customer does not require access to the certifier ID and ID password.
Having enabled certifiers for the CA process, they can now assign the registration authority role to administrators, who can then register users and manage certificate requests without having to provide the certifier ID and password.
My question is: is this compatible with the requirements of Oracle Identity Manager Connector for IBM Lotus Notes and Domino Release 9.0.4, that, among other parameters, requires to specify CertPath (Complete file specification of the certifier ID to be used when creating certifier ID files) and CertPwd (Password of the certifier ID file)?
Regards,
Angelo Carugati

I quite new with OIM, but not at all... For sure, I need to configure a connector for Lotus Notes / Domino.
The main points in my question are (USING A connector for Lotus Notes / Domino):
- How can I create 1 user account (and related data), on different servers (IT Resources), with different "mail templates", when the data should be the same, and the user mail database, should only be a replica on the the 2nd server
- Maybe, I need to configure 2 distincts IT Resources, and run both (through Provisioning Policies), when I need to provision a user, as described in my scenario (above), right?
- In the 2nd server, I dont want the user to be created with a new mail database (neither new user data, as shortName, IDfile... ).
I want that same data, and a replicated mail DB is generated on the 2nd server (webmail server)
Is it possible, how can I configure this within OIM connector for Lotus Notes / Domino?

Certification Authority Web Enrollment Install Error

Hello
We have moved our certification authority from "Windows Server 2008" to "Windows Server 2008 R2" according this blog entry:
http://www.scottfeltmann.com/index.php/2010/03/02/move-root-ca-from-w2k3-to-w2k8/
It works perfectly. After that we wanted to install "Certificate Authority Web Enrollment" in Server Manager, but the following error appears:
"Cannot install Certification Authority Web Enrollment, Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0x80070057 (WIN32: 87)"
Thanks for any help!
Regards
netbit

Hello Marcin
Thanks for your answer. The CA is now on a single server without any roles installed.
There are no events in the eventvwr for this error or anything else.
Just for clarification: If i try to select "Certificate Authority Web Enrollment" in the servermanager the error appears:
Screenshot: http://giezi.com/public/servermanager-error.PNG
Thanks!
Regards
Reto

Certification authority issues

Similar Messages

Maybe you are looking for